有解决问题时需要反汇编,然后在汇编模式阅读代码,因外汇编相比于C 代码或者其他语言更加直接的体现CPU的行为.本文着重分析如何阅读汇编语句,常用的函数调用,变量定义,压栈,出栈等行为.
C代码
定义一个函数,带有6个参数的函数
int add(void *a,void *b,void *c,void *d,int e,int f)
{
int m = e;
int n = f;
return (*((int *)a) + *((int *)b) + *((int *)c) + *((int *)d) + m + n);
}
定义一个无参数函数
int test(void)
{
int array[100] = {0};
int b = 0;
memset(array,0x01,sizeof(array));
for(int i=0;i<100;i++)
{
b += array[i];
}
return b;
}
定义一个main函数
int main(unsigned int argc,void *argv[])
{
char p[10]= {'\0','A'};
int a = 10;
int b = 10;
int c = 100;
int d = 1000;
printf("\r\nStart test the demo\r\n");
c = add((void *)&a,(void *)&b,(void *)&c,(void *)&d,a,b);
d = test();
// d = add(NULL,NULL);
sleep(100);
return 0;
}
可执行文件反汇编
将.c文件编译为可执行文件,然后将可执行文件反汇编生成汇编码.
1.Add 函数汇编代码
int add(void *a,void *b,void *c,void *d,int e,int f)
{
8560: 1421 subi r14, r14, 4
8562: dd0e2000 st.w r8, (r14, 0x0)
8566: 6e3b mov r8, r14
8568: 1426 subi r14, r14, 24
856a: e588100b subi r12, r8, 12
856e: dc0c2000 st.w r0, (r12, 0x0)
8572: e408100f subi r0, r8, 16
8576: b020 st.w r1, (r0, 0x0)
8578: e4281013 subi r1, r8, 20
857c: b140 st.w r2, (r1, 0x0)
857e: e4481017 subi r2, r8, 24
8582: b260 st.w r3, (r2, 0x0)
int m = e;
8584: e4681003 subi r3, r8, 4
8588: e4480003 addi r2, r8, 4
858c: 9240 ld.w r2, (r2, 0x0)
858e: b340 st.w r2, (r3, 0x0)
int n = f;
8590: e4681007 subi r3, r8, 8
8594: e4480007 addi r2, r8, 8
8598: 9240 ld.w r2, (r2, 0x0)
859a: b340 st.w r2, (r3, 0x0)
return (*((int *)a) + *((int *)b) + *((int *)c) + *((int *)d) + m + n);
859c: e468100b subi r3, r8, 12
85a0: 9360 ld.w r3, (r3, 0x0)
85a2: 9340 ld.w r2, (r3, 0x0)
85a4: e468100f subi r3, r8, 16
85a8: 9360 ld.w r3, (r3, 0x0)
85aa: 9360 ld.w r3, (r3, 0x0)
85ac: 608c addu r2, r3
85ae: e4681013 subi r3, r8, 20
85b2: 9360 ld.w r3, (r3, 0x0)
85b4: 9360 ld.w r3, (r3, 0x0)
85b6: 608c addu r2, r3
85b8: e4681017 subi r3, r8, 24
85bc: 9360 ld.w r3, (r3, 0x0)
85be: 9360 ld.w r3, (r3, 0x0)
85c0: 608c addu r2, r3
85c2: e4681003 subi r3, r8, 4
85c6: 9360 ld.w r3, (r3, 0x0)
85c8: 608c addu r2, r3
85ca: e4681007 subi r3, r8, 8
85ce: 9360 ld.w r3, (r3, 0x0)
85d0: 60c8 addu r3, r2
}
-局部变量定义
int m = e;
8584: e4681003 subi r3, r8, 4
8588: e4480003 addi r2, r8, 4
858c: 9240 ld.w r2, (r2, 0x0)
858e: b340 st.w r2, (r3, 0x0)
int n = f;
8590: e4681007 subi r3, r8, 8
8594: e4480007 addi r2, r8, 8
8598: 9240 ld.w r2, (r2, 0x0)
859a: b340 st.w r2, (r3, 0x0)
r8 寄存器为:fp 寄存器；r14：用户堆栈寄存器；在栈中分配4字节的空间. 4是偏移量不是大小,r8 开始向下偏移4个字节。
subi r3, r8, 4
ld 与st 指令要根据CPU框架说明解释,这里是Csky CPU,请参阅Csky汇编手册.
2.调用无参函数
bsr指令直接跳转并且保存子程序的返回地址到R15寄存器中
d = test();
bsr 0x85e0 // 85e0 <test>
8726: c4004820 lsli r0, r0, 0
872a: 6c83 mov r2, r0
872c: e468101f subi r3, r8, 32
8730: b340 st.w r2, (r3, 0)
可以看到程序并没有直接操作FP寄存器，而是在FP的基础之上进行偏移，FP指针始终没有移动。
函数返回
6c0f mov r0, r3
8668: 6fa3 mov sp, r8
866a: d9ee2001 ld.w r15, (sp, 0x4)
866e: d90e2000 ld.w r8, (sp, 0)
8672: 1402 addi sp, sp, 8
8674: 783c rts
函数调用返回时，首先恢复栈到FP，然后再恢复SP，最后使用rts实现函数跳转。
3.调用有参函数
参数个数小于4个
参数个数大于4个
